Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- REGISTRY QUERY
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
REGISTRY QUERY
hi
i try to query a registry key but Nothing is displayed
index="" sourcetype=WinRegistry key_path="\REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.*
could you bring me help please?
IN INPUT/
[WinRegMon://hkcu_run1]
disabled = 0
hive = \REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.
proc = .*
type = set|create|delete|rename
index = windows
thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it works until :
index="" sourcetype="winregistry" key_path="\registry\user
but after un have an error message:
⚠ Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please share the search.log information
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BUTut i got results Index="windows" sourcetype=WinRegistry
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After getting above data can you select the key_path from selected fields? Also can you try to find out Event Code 4657 ?
This doc may help:
https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5a3187b4419202f0fb8b2dd1/151319544...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hI loglognathan Nothing is also displayed....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please try this query
index="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Master\ConfigurationCountry.*
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi
now i use this request but Nothing is displayed.
index="" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Airbus\Master\ConfigurationCountry."
an idea please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please try only this query
ndex="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please provide the SS of Index="windows" sourcetype=WinRegistry
or please provide the result sample
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
